> 本文作者：丁辉

# Keepalived部署使用

> 介绍：当前配置完全可以在大规模生产集群中使用

|   节点   |    网关IP    |     VIP      |
| :------: | :----------: | :----------: |
| 主网关一 | 192.168.1.11 |              |
| 从网关二 | 192.168.1.12 |              |
|          |              | 192.168.1.10 |

## 开始部署

1. 安装 keepalived

   ```bash
   yum install -y keepalived
   ```

2. **主节点** 和 **从节点** 备份 Keepalived 配置文件

   ```bash
   mv /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak
   ```

3. **主节点** 编辑配置文件

   ```bash
   vi /etc/keepalived/keepalived.conf
   ```

   内容如下

   ```bash
   ! Configuration File for keepalived
     
   global_defs {
       router_id LVS_DEVEL           # 路由器标识，区分不同keepalived实例
       script_user root              # 执行脚本的用户
       enable_script_security        # 启用脚本安全限制
   }
   
   vrrp_script chk_haproxy {         # 定义健康检查脚本
       script "/usr/bin/killall -0 haproxy"  # 检查haproxy进程是否存在
       interval 2                    # 检查间隔(秒)
       weight -20                    # 检查失败时优先级减20
       fall 2                        # 连续2次失败认为节点故障
       rise 2                        # 连续2次成功认为节点恢复
   }
   
   # vrrp_script check_health {
     # 检测脚本
     # script "/etc/keepalived/check_health_status.sh"
     # 执行间隔时间
     # interval 5
   # }
   
   vrrp_instance VI_1 { # VRRP实例定义
       # track_script { # 开启检测脚本
           # check_health
       # }
       # 备用状态(当 MASTER 宕机之后根据优先级提升 BACKUP 为 MASTER)
       state BACKUP
       # 网卡设备名
       interface eth0
       # 虚拟路由器ID(1-255)，集群内唯一
       virtual_router_id 50
       # 优先级(1-254)，越高越优先
       priority 100
       # VRRP通告间隔(秒)
       advert_int 1
       # 非抢占模式
       nopreempt
       # 本机源IP(单播模式)
       unicast_src_ip 192.168.1.11
       # 对端IP列表(单播模式)
       unicast_peer { 
           192.168.1.12
       }
       
       authentication { # 认证配置
           # 认证类型：PASS/AH
           auth_type PASS
            # 认证密码(8位以内)
           auth_pass 1111
       }
       
       virtual_ipaddress { # 虚拟IP配置
           # 192.168.1.10/24 # VIP地址/掩码(单网卡模式)
           192.168.1.10/24 dev eth0 # VIP地址/掩码(多网卡模式)
       }
       
       track_interface { # 路由检测, 通过检测指定的网卡是否存在来判断服务是否正常
           eth0
       }
       
       notify_master "/etc/keepalived/notify.sh master"    # 成为 master 时执行
       notify_backup "/etc/keepalived/notify.sh backup"    # 成为 backup 时执行  
       notify_fault "/etc/keepalived/notify.sh fault"      # 故障时执行
   }
   ```

4. **从节点** 编辑配置文件

   ```bash
   vi /etc/keepalived/keepalived.conf
   ```

   内容如下

   ```bash
   ! Configuration File for keepalived
     
   global_defs {
       router_id LVS_DEVEL           # 路由器标识，区分不同keepalived实例
       script_user root              # 执行脚本的用户
       enable_script_security        # 启用脚本安全限制
   }
   
   vrrp_script chk_haproxy {         # 定义健康检查脚本
       script "/usr/bin/killall -0 haproxy"  # 检查haproxy进程是否存在
       interval 2                    # 检查间隔(秒)
       weight -20                    # 检查失败时优先级减20
       fall 2                        # 连续2次失败认为节点故障
       rise 2                        # 连续2次成功认为节点恢复
   }
   
   # vrrp_script check_health {
     # 检测脚本
     # script "/etc/keepalived/check_health_status.sh"
     # 执行间隔时间
     # interval 5
   # }
   
   vrrp_instance VI_1 { # VRRP实例定义
       # track_script { # 开启检测脚本
           # check_health
       # }
       # 备用状态(当 MASTER 宕机之后根据优先级提升 BACKUP 为 MASTER)
       state BACKUP
       # 网卡设备名
       interface eth0
       # 虚拟路由器ID(1-255)，集群内唯一
       virtual_router_id 50
       # 优先级(1-254)，越高越优先
       priority 50
       # VRRP通告间隔(秒)
       advert_int 1
       # 非抢占模式
       nopreempt
       # 本机源IP(单播模式)
       unicast_src_ip 192.168.1.12
       # 对端IP列表(单播模式)
       unicast_peer { 
           192.168.1.11
       }
       
       authentication { # 认证配置
           # 认证类型：PASS/AH
           auth_type PASS
            # 认证密码(8位以内)
           auth_pass 1111
       }
       
       virtual_ipaddress { # 虚拟IP配置
           # 192.168.1.10/24 # VIP地址/掩码(单网卡模式)
           192.168.1.10/24 dev eth0 # VIP地址/掩码(多网卡模式)
       }
       
       track_interface { # 路由检测, 通过检测指定的网卡是否存在来判断服务是否正常
           eth0
       }
       
       notify_master "/etc/keepalived/notify.sh master"    # 成为 master 时执行
       notify_backup "/etc/keepalived/notify.sh backup"    # 成为 backup 时执行  
       notify_fault "/etc/keepalived/notify.sh fault"      # 故障时执行
   }
   ```

5. 配置通知脚本

   ```bash
   cat > /etc/keepalived/notify.sh <<'EOF'
   #!/bin/bash
   TYPE=$1
   NAME=$2
   STATE=$3
   
   case $STATE in
       "MASTER")
           echo "$(date): 进入MASTER状态，虚拟IP已绑定" >> /var/log/keepalived.log
           # 可以在这里重启负载均衡器或相关服务
           ;;
       "BACKUP")
           echo "$(date): 进入BACKUP状态" >> /var/log/keepalived.log
           ;;
       "FAULT")
           echo "$(date): 进入FAULT状态" >> /var/log/keepalived.log
           ;;
   esac
   EOF
   ```

6. 分配脚本权限

   ```bash
   chmod +x /etc/keepalived/notify.sh
   ```

7. 启动 keepalived

   ```bash
   systemctl start keepalived
   systemctl enable keepalived
   systemctl status keepalived
   ```

## 配置健康检测

1. 编辑脚本

   ```bash
   vi /etc/keepalived/check_health_status.sh
   ```

   内容如下

   ```bash
   #!/bin/bash                                                                                             
   /usr/bin/curl -I http://localhost:10254/healthz 
     
   if [ $? -ne 0 ];then
                                                                        
        cat /var/run/keepalived.pid | xargs kill
     
   fi
   ```

2. 授权

   ```bash
   chmod +x /etc/keepalived/check_health_status.sh
   ```

3. 确保服务启动后，编辑 keepalived 配置文件取消检测注释，重启后生效

   ```bash
   systemctl restart keepalived
   ```

## 配置 Keepalived 自恢复

> 更改 Keepalived Systemd 配置文件, 加入如下内容, Keepalived会一直重启检测服务是否恢复正常

```bash
vi /lib/systemd/system/keepalived.service
```

```bash
[Service]
# 总是重启该服务
Restart=always
# 重启间隔时间
RestartSec=10
```

## 防火墙配置

> 开放其中一种即可

- 允许vrrp流量

  ```bash
  iptables -A INPUT -p vrrp -j ACCEPT
  ```

- 允许组播流量

  ```bash
  iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT
  ```